We’d do it from root (/) and drill down from there, it was usually /var/lib or /var/logs that was filling up, but occasionally someone would upload a 4.5 GB file to their home folder which has a quota of 5 GB.
Using ncdu would have been the best way, but that would require it being installed on about 7 thousand machines.